A method is performed at a client device distinct from an application server. In the method, a first key is stored in a secure store of the client device. A wrapped second key is received from the application server. The first key is retrieved from the secure store and used to unwrap the second key. Encrypted media content and a media control command to control playback of the media content is received from the application server. The content is decrypted using the unwrapped second key, and decoded for playback. During playback of the media content, a play position of the decrypted media content is transmitted to the application server and the decrypted media content is transmitted to a display device that is coupled to the client device. The decrypted media content is displayed in accordance with the received media control command.